This Week in Cybersecurity News
PoSeidon, Brother of Zeus, Forks up Point of Sale Terminals by Darren Pauli, The Register
Cisco researchers have found a new breed of PoS malware, called “PoSeidon.” The new malware is built on top of the Zeus exploit kit and is an improved version of BlackPOS which was used in the 2013 Target breach. PoSeidon contains a loader that maintains persistence on infected boxes to survive reboots and user log-outs.
NJRat Making a Comeback, Researchers Observe by Adam Greenberg, SC Magazine
NJRat is making a comeback according to researchers at PhishMe. The malware is being delivered via email and contains a link to file stored on eDisk called “NSFW_Car_Changer.exe” which contains the malware. The executable is compiled with .NET 4.0 making it harder to decode than malware written in C/C++
Researchers Use Heat to Breach Air-Gapped Systems by Jai Vijayan, Dark Reading
Researchers from the Cyber Security Research Center at Israel’s Ben-Gurion University have shown that two air-gapped systems can be breached using heat and their built-in thermal sensors. The method, being called BitWhisper, is the first time researchers have been able to establish a bi-directional communication channel between two air-gapped systems.
Android Hijacking Bug may Allow Attackers to Install Password-Stealers by Dan Goodin, Ars Technica
Roughly half of all Android handsets are vulnerable to the “Android installer hijacking” vulnerability which allows hackers to replace seemingly benign apps with malicious ones that steal passwords and other sensitive data. The vulnerability only works when apps are being downloaded from third-party app stores or when a user clicks on an app promotion advertisement hosted by a mobile advertisement library.
Zero Day, Web Browser Vulnerabilities Spike in 2014 by Jeremy Kirk, IDG News Service
Zero-day vulnerabilities rose from 14 in 2013 to 25 in 2014 according to Secunia. Flaws in Web browser software increased from 728 in 2013 to 1,035 in 2014. However, vendors are fixing the flaws faster with over 83 percent of the 15,435 vulnerabilities found in 2014 had a patch available by the time the flaw was publicly disclosed compared with 78.5 percent in 2013.
ICYMI Threat Geek Post of the Week: A New Day in Breach Resolution: Implications of Target Class Action Settlement by Jim Jaeger